fix(kernel): Mass_formulary.t.said is honestly optional -- was false for Votive

The .mli promised said is "the slug whose Mass is said". For Votive
(RG 78/309(a), the Saturday votive Mass of Our Lady) it was set to the
day's own ferial slug -- whose Mass is exactly the one NOT said. A
consumer joining rubrics to readings on that slug would silently get
the wrong Mass: 2026-01-03 reports ef-christmas-1-saturday, which has
zero entries in data/ef/lectionary.sexp, because the citations
actually come from bvm_saturday_citations, a season-keyed function
with no slug of its own anywhere in the shipped data.

Chose the type-honest fix over the interim documentation one: said is
now Slug.t option, None exactly for Votive, because there is
genuinely no slug in the shipped data this field could report for
that one source. Adding real ids for the five seasonal BVM Masses
(the reviewer's first option) is out of scope -- a data restructuring
this round explicitly does not carry. Threading the office slug
through a second field was considered and rejected as redundant: the
day's own office is already available on the same Liturgical_day.t
via observed.slug, which every caller already has in scope regardless
of via, so said does not need to duplicate it.

colitur rubrics stays byte-identical: rubrics_line already has
d.observed in scope and falls back to its slug when said is None,
printing the exact value it always printed for a Votive row (verified
directly, diffed against pre-fix output across four years). colitur
day/readings are unaffected (neither reads Mass_formulary at all).

colitur emit --format sexp's pretty-printed line count for 2027 moved
9011 -> 9025: every day's formulary record widened by said's own
extra option wrapping, and to_string_hum wraps by column width.
Cosmetic only, diffed line by line to confirm every change is this
shape or a consequent wrap shift; recorded in test/cli.t alongside the
476(f) note it now sits next to.

1 files changed, 13 insertions, 2 deletions

diff --git a/test/test_lms_ordo.ml b/test/test_lms_ordo.ml
index cff4b3d..a728cbc 100644
--- a/test/test_lms_ordo.ml
+++ b/test/test_lms_ordo.ml
@@ -302,7 +302,9 @@ let describe_creed_mismatch (o : ordo_row) (c : colitur_row) =
   Printf.sprintf "%s %S: colitur creed=%b, Ordo creed=%b (formulary=%s)" o.date o.title c.c_creed
     (Option.get o.creed)
     (match c.c_formulary with
-    | Some f -> Colitur_kernel.Slug.to_string f.MF.said
+    | Some { MF.said = Some s; _ } -> Colitur_kernel.Slug.to_string s
+    | Some { MF.said = None; via = MF.Votive } -> "votive (said unnamed in the data)"
+    | Some { MF.said = None; _ } -> "NONE (said, unexpectedly outside Votive)"
     | None -> "NONE")
 
 (* The core assertion: every Creed divergence, over all 400 days (Good
@@ -587,7 +589,16 @@ let test_formulary_override_matches () =
                     :: !bad
       | Some { MF.via = MF.Preceding_sunday; said } -> (
           bump "preceding_sunday";
-          let slug = Colitur_kernel.Slug.to_string said in
+          (* [said] is [Some] for every constructor except [Votive] (see
+             {!Colitur_kernel.Mass_formulary.t}'s own citation) -- a bare
+             [Option.get] here would raise an unhelpful exception if that
+             ever stopped being true; [Alcotest.failf] names the day
+             instead. *)
+          let slug =
+            match said with
+            | Some s -> Colitur_kernel.Slug.to_string s
+            | None -> Alcotest.failf "%s: Preceding_sunday day with said = None (should be impossible)" o.date
+          in
           let ordo_says = Printf.sprintf "Mass of %s" in
           (* Try the generic [ef-<season>-sunday-<n>] shape first; fall back
              to the one NAMED Sunday that also reaches this population